3
l_3 @ sp d dl mZmZmZ d dlZd dlZd dlmZ d dlZd dl m
Z
d dl m Z d dl
mZmZmZ e j e j e j e j e j dZG dd d eZG d
d d eZd d
eD Ze je je je je jfZdd ZG dd deZ dd
e D Z dd Z dd Z G dd de Z!G dd de Z"G dd d e Z#ej$ej%G d d d e Z&ej$ej%G d d d e Z'dS )! )absolute_importdivisionprint_functionN)Enum)x509)hashes)_EARLIEST_UTC_TIME_convert_to_naive_utc_time_reject_duplicate_extension)z
1.3.14.3.2.26z2.16.840.1.101.3.4.2.4z2.16.840.1.101.3.4.2.1z2.16.840.1.101.3.4.2.2z2.16.840.1.101.3.4.2.3c @ s e Zd ZdZdZdS )OCSPResponderEncodingzBy HashzBy NameN)__name__
__module__ __qualname__ZHASHNAME r r /usr/lib64/python3.6/ocsp.pyr s r c @ s$ e Zd ZdZdZdZdZdZdZdS )OCSPResponseStatusr N) r r
r
SUCCESSFULZMALFORMED_REQUESTZINTERNAL_ERRORZ TRY_LATERZ SIG_REQUIREDZ UNAUTHORIZEDr r r r r $ s r c C s i | ] }||j qS r )value).0xr r r
- s r c C s t | tstdd S )Nz9Algorithm must be SHA1, SHA224, SHA256, SHA384, or SHA512)
isinstance_ALLOWED_HASHES
ValueError) algorithmr r r _verify_algorithm7 s
r! c @ s e Zd ZdZdZdZdS )OCSPCertStatusr r r N)r r
r ZGOODREVOKEDZUNKNOWNr r r r r" > s r" c C s i | ] }||j qS r )r )r r r r r r D s c C s ddl m} |j| S )Nr )backend),cryptography.hazmat.backends.openssl.backendr$ load_der_ocsp_request)datar$ r r r r& G s r& c C s ddl m} |j| S )Nr )r$ )r% r$ load_der_ocsp_response)r' r$ r r r r( M s r( c @ s2 e Zd Zdg fddZdd Zdd Zdd ZdS )
OCSPRequestBuilderNc C s || _ || _d S )N)_request _extensions)selfZrequest
extensionsr r r __init__T s zOCSPRequestBuilder.__init__c C sP | j d k rtdt| t|tj s6t|tj r>tdt|||f| jS )Nz.Only one certificate can be added to a requestz%cert and issuer must be a Certificate) r* r r! r r Certificate TypeErrorr) r+ )r, certissuerr r r r add_certificateX s
z"OCSPRequestBuilder.add_certificatec C sD t |tjstdtj|j||}t|| j t| j | j|g S )Nz"extension must be an ExtensionType)
r r
ExtensionTyper0 Extensionoidr
r+ r) r* )r, extensioncriticalr r r
add_extensiond s z OCSPRequestBuilder.add_extensionc C s( ddl m} | jd kr td|j| S )Nr )r$ z*You must add a certificate before building)r% r$ r* r Zcreate_ocsp_request)r, r$ r r r buildo s
zOCSPRequestBuilder.build)r r
r r. r3 r9 r: r r r r r) S s r) c @ s e Zd Zdd ZdS )_SingleResponsec C s t |tj s t |tj r$tdt| t |tjs@td|d k r^t |tj r^td|| _|| _|| _|| _ || _
t |t std|t j k r|d k rt
d|d k rt
dnNt |tjstdt|}|tk rt
d|d k rt |tj rtd || _|| _|| _d S )
Nz%cert and issuer must be a Certificatez%this_update must be a datetime objectz-next_update must be a datetime object or Nonez8cert_status must be an item from the OCSPCertStatus enumzBrevocation_time can only be provided if the certificate is revokedzDrevocation_reason can only be provided if the certificate is revokedz)revocation_time must be a datetime objectz7The revocation_time must be on or after 1950 January 1.zCrevocation_reason must be an item from the ReasonFlags enum or None)r r r/ r0 r! datetimeZ_certZ_issuerZ
_algorithmZ _this_updateZ _next_updater" r# r r r Z ReasonFlagsZ _cert_statusZ_revocation_timeZ_revocation_reason) r, r1 r2 r cert_status this_update next_updaterevocation_timerevocation_reasonr r r r. y sJ
z_SingleResponse.__init__N)r r
r r. r r r r r; x s r; c @ sR e Zd Zdddg fddZdd Zdd Zdd Zd
d Zd d
Ze dd Z
dS )OCSPResponseBuilderNc C s || _ || _|| _|| _d S )N) _response
_responder_id_certsr+ )r, Zresponse responder_idcertsr- r r r r. s z OCSPResponseBuilder.__init__c
C s< | j d k rtdt||||||||} t| | j| j| jS )Nz#Only one response per OCSPResponse.)rC r r; rB rD rE r+ )
r, r1 r2 r r= r> r? r@ rA Z
singlerespr r r add_response s
z OCSPResponseBuilder.add_responsec C sP | j d k rtdt|tjs&tdt|ts8tdt| j||f| j | j
S )Nz!responder_id can only be set oncez$responder_cert must be a Certificatez6encoding must be an element from OCSPResponderEncoding) rD r r r r/ r0 r rB rC rE r+ )r, encodingZresponder_certr r r rF s
z OCSPResponseBuilder.responder_idc C s\ | j d k rtdt|}t|dkr.tdtdd |D sHtdt| j| j|| j S )Nz!certificates may only be set oncer z certs must not be an empty listc s s | ]}t |tjV qd S )N)r r r/ )r r r r r s z3OCSPResponseBuilder.certificates..z$certs must be a list of Certificates)
rE r listlenallr0 rB rC rD r+ )r, rG r r r certificates s
z OCSPResponseBuilder.certificatesc C sL t |tjstdtj|j||}t|| j t| j | j
| j | j|g S )Nz"extension must be an ExtensionType) r r r4 r0 r5 r6 r
r+ rB rC rD rE )r, r7 r8 r r r r9 s z!OCSPResponseBuilder.add_extensionc C sB ddl m} | jd kr td| jd kr0td|jtj| ||S )Nr )r$ z&You must add a response before signingz*You must add a responder_id before signing)r% r$ rC r rD create_ocsp_responser r )r, Z private_keyr r$ r r r sign s
zOCSPResponseBuilder.signc C s@ ddl m} t|ts td|tjkr0td|j|d d d S )Nr )r$ z7response_status must be an item from OCSPResponseStatusz$response_status cannot be SUCCESSFUL)r% r$ r r r0 r r rO )clsresponse_statusr$ r r r build_unsuccessful s
z&OCSPResponseBuilder.build_unsuccessful) r r
r r. rH rF rN r9 rP classmethodrS r r r r rB s rB c @ s` e Zd Zejdd Zejdd Zejdd Zejdd Zej d d
Z
ejd d Z d
S ) OCSPRequestc C s dS )z3
The hash of the issuer public key
Nr )r, r r r issuer_key_hash0 s zOCSPRequest.issuer_key_hashc C s dS )z-
The hash of the issuer name
Nr )r, r r r issuer_name_hash6 s z OCSPRequest.issuer_name_hashc C s dS )zK
The hash algorithm used in the issuer name and key hashes
Nr )r, r r r hash_algorithm< s zOCSPRequest.hash_algorithmc C s dS )zM
The serial number of the cert whose status is being checked
Nr )r, r r r
serial_numberB s zOCSPRequest.serial_numberc C s dS )z/
Serializes the request to DER
Nr )r, rI r r r public_bytesH s zOCSPRequest.public_bytesc C s dS )zP
The list of request extensions. Not single request extensions.
Nr )r, r r r r- N s zOCSPRequest.extensionsN) r r
r abcabstractpropertyrV rW rX rY abstractmethodrZ r- r r r r rU . s rU c @ s$ e Zd Zejdd Zejdd Zejdd Zejdd Zejd d
Z ejd d Z
ejd
d Z ejdd Z ejdd Z
ejdd Zejdd Zejdd Zejdd Zejdd Zejd d Zejd d Zejd!d" Zejd#d$ Zejd%d& Zejd'd( Zd)S )* OCSPResponsec C s dS )zm
The status of the response. This is a value from the OCSPResponseStatus
enumeration
Nr )r, r r r rR W s z OCSPResponse.response_statusc C s dS )zA
The ObjectIdentifier of the signature algorithm
Nr )r, r r r signature_algorithm_oid^ s z$OCSPResponse.signature_algorithm_oidc C s dS )zX
Returns a HashAlgorithm corresponding to the type of the digest signed
Nr )r, r r r signature_hash_algorithmd s z%OCSPResponse.signature_hash_algorithmc C s dS )z%
The signature bytes
Nr )r, r r r signaturej s zOCSPResponse.signaturec C s dS )z+
The tbsResponseData bytes
Nr )r, r r r tbs_response_bytesp s z OCSPResponse.tbs_response_bytesc C s dS )z
A list of certificates used to help build a chain to verify the OCSP
response. This situation occurs when the OCSP responder uses a delegate
certificate.
Nr )r, r r r rN v s zOCSPResponse.certificatesc C s dS )z2
The responder's key hash or None
Nr )r, r r r responder_key_hash~ s z OCSPResponse.responder_key_hashc C s dS )z.
The responder's Name or None
Nr )r, r r r responder_name s zOCSPResponse.responder_namec C s dS )z4
The time the response was produced
Nr )r, r r r produced_at s zOCSPResponse.produced_atc C s dS )zY
The status of the certificate (an element from the OCSPCertStatus enum)
Nr )r, r r r certificate_status s z OCSPResponse.certificate_statusc C s dS )z^
The date of when the certificate was revoked or None if not
revoked.
Nr )r, r r r r@ s z OCSPResponse.revocation_timec C s dS )zi
The reason the certificate was revoked or None if not specified or
not revoked.
Nr )r, r r r rA s z OCSPResponse.revocation_reasonc C s dS )z
The most recent time at which the status being indicated is known by
the responder to have been correct
Nr )r, r r r r> s zOCSPResponse.this_updatec C s dS )zC
The time when newer information will be available
Nr )r, r r r r? s zOCSPResponse.next_updatec C s dS )z3
The hash of the issuer public key
Nr )r, r r r rV s z OCSPResponse.issuer_key_hashc C s dS )z-
The hash of the issuer name
Nr )r, r r r rW s z OCSPResponse.issuer_name_hashc C s dS )zK
The hash algorithm used in the issuer name and key hashes
Nr )r, r r r rX s zOCSPResponse.hash_algorithmc C s dS )zM
The serial number of the cert whose status is being checked
Nr )r, r r r rY s zOCSPResponse.serial_numberc C s dS )zR
The list of response extensions. Not single response extensions.
Nr )r, r r r r- s zOCSPResponse.extensionsc C s dS )zR
The list of single response extensions. Not response extensions.
Nr )r, r r r single_extensions s z OCSPResponse.single_extensionsN)r r
r r[ r\ rR r_ r` ra rb rN rc rd re rf r@ rA r> r? rV rW rX rY r- rg r r r r r^ U s( r^ )(Z
__future__r r r r[ r< enumr ZsixZ cryptographyr Z cryptography.hazmat.primitivesr Zcryptography.x509.baser r r
ZSHA1ZSHA224ZSHA256ZSHA384ZSHA512Z
_OIDS_TO_HASHr r Z_RESPONSE_STATUS_TO_ENUMr r! r" Z_CERT_STATUS_TO_ENUMr& r( objectr) r; rB Z
add_metaclassABCMetarU r^ r r r r s@ %Fp&